Device-list authorization + DO-first control plane (listauth)

[azooz2003-bit]

Implements the connection-architecture redesign specified in the living design artifact (hq cmux-assets/irx-client-resilience/irx-sequence-diagram): device-list authorization replaces pair-grant JWS verification, and the account Durable Object becomes the control plane for registration confirmation, device-list sync, acks, and revocation.

Backend (workers/presence): listv2 overlay in the AccountControlPlane DO (status enum + revoked + appVersion/track/capabilities per device, seeded-on-first-sight, confirm-on-hello), directory freshness lease (issuedAt + 24h ttl, snapshot_complete re-stamps), per-device ack(rev) with alarm retries (5s/30s/2m/10m/hourly), POST /v1/control/devices/revoke (instant broadcast, socket close 1008, mint denial). Schemas extended additively + quicktype regenerated (TS + Swift), drift guard green. 240 worker tests.

Clients (both platforms): grantless hello v2; Mac admission = IrxListJudge (EndpointID in list AND !revoked AND lease fresh, synchronous O(1), fail closed on stale/absent); revocation closes live sessions; iOS dial gate + seeded-Mac warning row (en+ja); device-list lease persisted in Keychain (ThisDeviceOnly, keyed account|backend); broker JSON caches move to Keychain in Release with one-way file migration; control-plane client sends client info + acks and starts before broker calls. 62 + 338 package tests.

Transport hardening found by the gates: keepalive now requires two consecutive pong misses before declaring death (a lone 2s stall severed an otherwise-perfect 9-min session; the Mac's pong landed 85ms past the deadline), and automatic path mode now actually authorizes NAT traversal after admission (deferNatTraversalUntilAuthorized was set at bind but nothing ever authorized, so sessions could never leave the relay — the known "direct-path unverified" v1 gap).

Also fixes a main compile break: AgentHibernationRecord.processLiveness had an inline default, excluding it from the memberwise init used by +Records.swift (#10658 fallout; the PR lane has no macOS compile gate).

Acceptance gates run live (isolated sim as iPhone, tagged Mac, isolated dev worker cmux-presence-dev-listauth proxying staging; harness scripts/listauth-gates.py; evidence in hq cmux-assets/irx-client-resilience/listauth-gates-evidence/):

• 30-min relay soak PASS: 338/338 relay pongs, 0 reconnects/disconnects, 77/70 pass rotations and 4 list pushes crossed with zero session impact, 60 inputs, establish 93ms.
• 30-min direct/LAN soak PASS: 344/344 pongs on the direct path (rtt 0ms after NAT-traversal upgrade), 0 breaks, 77/77 rotations, establish 70ms.
• Cold start PASS: directory ("see all computers") 711–1313ms (<2s), session admitted 1457–2105ms (<3s transport target). Timing anchored at the signed-in moment because the sim re-runs a ~15s UITEST password sign-in every launch (dev-env artifact; product devices restore sessions locally).
• Background-return gate (30-min hold) running at PR time; result posted as a comment.

Deferred by design decision: the full sign-in→terminal XCUITest (post-implementation design pass), hint-rev acks, Mac account-erase seam for broker caches (pre-existing), MobileMacListAuthState singleton seam.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Replaces pair-grant JWS verification with device-list authorization and moves directory sync, acks, and revocation into the per-account control-plane Durable Object. Admission checks the Mac's endpoint against a persisted 24h-leased device list; revoked devices are cut immediately and denied future admission, and clients ack applied control-plane revisions so the server's retry ladder stops at them.

Transport and client behavior

• Keepalive now requires two consecutive pong misses; automatic path mode authorizes NAT traversal after admission; foreground resume replaces zombie sessions immediately; explicit redial invalidates the old session first; the control lane no longer closes the shared QUIC session; reconnect liveness and lease freshness run on the monotonic clock so wall-clock rollback can't skip a zombie or revive a stale lease, and the persisted lease TTL is capped so a corrupt snapshot can't overflow the refresh math.
• The broker mint retries once on a stale kept-alive connection and keeps the URL-error cause; Release broker caches move to the Keychain behind a one-way, account- and backend-scoped migration that preserves data and rejects replayed or wall-rolled-back leases; Settings Networking now reflects the irx runtime and throws on unsupported mutations.
• Pairing QR codes carry the Mac's device ID, pairing attempts clear timed-out auth/token-suppression windows so fresh pairings persist their routes, and dev Macs publish registry routes to shared staging.

Control plane and infrastructure

• Control-plane wire types are generated from schemas/control-plane/ with a CI drift guard; transport state is namespaced per bundle and broker so dev and production builds can't overwrite each other's trust keys.
• The socket sends the app namespace so the DO presents devices hidden by dev-tag isolation; serialized control loops share no decoder state, recover from zombie sockets and snapshot-registry closes, and merge relay updates without double-minting; the dev-launch attach timeout rises to 60s for cold auth.
• Exposes AgentHibernationRecord.processLiveness to the memberwise initializer, fixing a main compile break.

^{Written for commit dfe4185. Summary will update on new commits.}

Summary by CodeRabbit

• New Features
  • Added live synchronization for device lists, relay updates, and grantless device admission.
  • Added persistent device-list state with improved sign-out cleanup.
  • Added IRX-backed Networking settings, live status updates, connection checks, and relay management.
  • Pairing QR codes now preserve Mac device identity while retaining legacy compatibility.
• Bug Fixes
  • Pairing and token requests recover promptly after timed-out authentication.
  • Improved connectivity diagnostics, retry handling, keepalive resilience, and relay-hint updates.
  • Added a “Not verified” warning for older Mac connections.

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="web/services/vms/images/devbox/cmux-bashrc">

<violation number="1" location="web/services/vms/images/devbox/cmux-bashrc:28">
P2: On E2B, Daytona, and Freestyle devbox images, this guard is never entered because neither build path creates `/etc/cmux/blesh-cache-seed`. Add the cache-generation, validation, and `cache.d` copy steps to the devbox Dockerfile and mirror them in the Freestyle replay before relying on this per-home seeding code.

(Based on your team's feedback about mirroring ble.sh cache generation in Freestyle replay.)</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: On E2B, Daytona, and Freestyle devbox images, this guard is never entered because neither build path creates /etc/cmux/blesh-cache-seed. Add the cache-generation, validation, and cache.d copy steps to the devbox Dockerfile and mirror them in the Freestyle replay before relying on this per-home seeding code.

(Based on your team's feedback about mirroring ble.sh cache generation in Freestyle replay.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At web/services/vms/images/devbox/cmux-bashrc, line 28:

<comment>On E2B, Daytona, and Freestyle devbox images, this guard is never entered because neither build path creates `/etc/cmux/blesh-cache-seed`. Add the cache-generation, validation, and `cache.d` copy steps to the devbox Dockerfile and mirror them in the Freestyle replay before relying on this per-home seeding code.

(Based on your team's feedback about mirroring ble.sh cache generation in Freestyle replay.) </comment>

<file context>
@@ -16,6 +16,29 @@ if [ ! -f "$HOME/.bash_history" ] && [ -f /etc/cmux/seed-history ]; then
+# lib/init-term.sh — ble.sh regenerates and prints unless the cache file is
+# NEWER than that file), so copy each seed entry that is missing or stale.
+# Plain cp (not -a) stamps now, which always beats init-term.sh.
+if [ -d /etc/cmux/blesh-cache-seed/blesh ]; then
+  __cmux_cache_base="${XDG_CACHE_HOME:-$HOME/.cache}"
+  for __cmux_seed in /etc/cmux/blesh-cache-seed/blesh/*/term.*; do
</file context>

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift">

<violation number="1" location="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift:137">
P2: When `URLSessionWebSocketTask.receive()` is the zombie, the timeout does not cancel the URLSession task until after the task group has waited for that receive to finish. Cancel the WebSocket from the timeout child before throwing so the timeout can actually unblock the reconnect loop.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: When URLSessionWebSocketTask.receive() is the zombie, the timeout does not cancel the URLSession task until after the task group has waited for that receive to finish. Cancel the WebSocket from the timeout child before throwing so the timeout can actually unblock the reconnect loop.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift, line 137:

<comment>When `URLSessionWebSocketTask.receive()` is the zombie, the timeout does not cancel the URLSession task until after the task group has waited for that receive to finish. Cancel the WebSocket from the timeout child before throwing so the timeout can actually unblock the reconnect loop.</comment>

<file context>
@@ -119,6 +119,35 @@ public actor IrxControlPlaneClient {
+                of: URLSessionWebSocketTask.Message.self
+            ) { group in
+                group.addTask { try await task.receive() }
+                group.addTask {
+                    try await Task.sleep(for: Self.receiveTimeout)
+                    throw ReceiveTimeout()
</file context>

Suggested change

	group.addTask {
	try await Task.sleep(for: Self.receiveTimeout)
	throw ReceiveTimeout()
	}
	group.addTask {
	try await Task.sleep(for: Self.receiveTimeout)
	task.cancel(with: .goingAway, reason: nil)
	throw ReceiveTimeout()
	}

[cubic-dev-ai]

1 issue found across 5 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxCtlListAuthOverlays.swift">

<violation number="1" location="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxCtlListAuthOverlays.swift:6">
P2: These generated value types already satisfy synthesized `Sendable`, but `@unchecked` disables compiler verification for every future schema change. Replace the unchecked conformances with ordinary `Sendable` conformances so a newly generated non-Sendable field fails at compile time instead of crossing the actor boundary unsafely.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: These generated value types already satisfy synthesized Sendable, but @unchecked disables compiler verification for every future schema change. Replace the unchecked conformances with ordinary Sendable conformances so a newly generated non-Sendable field fails at compile time instead of crossing the actor boundary unsafely.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxCtlListAuthOverlays.swift, line 6:

<comment>These generated value types already satisfy synthesized `Sendable`, but `@unchecked` disables compiler verification for every future schema change. Replace the unchecked conformances with ordinary `Sendable` conformances so a newly generated non-Sendable field fails at compile time instead of crossing the actor boundary unsafely.</comment>

<file context>
@@ -1,9 +1,15 @@
+// Generated wire values contain only immutable value types; make that fact
+// explicit so the actor's handler closures can receive decoded directory
+// payloads without changing the schema-generated source.
+extension Binding: @unchecked Sendable {}
+extension CTLDirectory: @unchecked Sendable {}
+extension CTLDirectoryPayload: @unchecked Sendable {}
</file context>

Suggested change

	extension Binding: @unchecked Sendable {}
	extension CTLDirectory: @unchecked Sendable {}
	extension CTLDirectoryPayload: @unchecked Sendable {}
	extension GrantVerificationKey: @unchecked Sendable {}
	extension PurpleMinimumSupportedVersion: @unchecked Sendable {}
	extension ReleaseTrack: @unchecked Sendable {}
	extension Status: @unchecked Sendable {}
	extension Binding: Sendable {}
	extension CTLDirectory: Sendable {}
	extension CTLDirectoryPayload: Sendable {}
	extension GrantVerificationKey: Sendable {}
	extension PurpleMinimumSupportedVersion: Sendable {}
	extension ReleaseTrack: Sendable {}
	extension Status: Sendable {}

[cubic-dev-ai]

1 issue found across 6 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift">

<violation number="1" location="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift:364">
P2: When a relay-pass frame arrives while a directory revision is pending, this ACK marks the directory revision applied even though `onRelayPasses` does not apply the device list. The DO can therefore clear its directory retry ladder and leave admission state stale; acknowledge only after applying a directory/hint fact, or track relay-pass acknowledgements separately.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: When a relay-pass frame arrives while a directory revision is pending, this ACK marks the directory revision applied even though onRelayPasses does not apply the device list. The DO can therefore clear its directory retry ladder and leave admission state stale; acknowledge only after applying a directory/hint fact, or track relay-pass acknowledgements separately.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift, line 364:

<comment>When a relay-pass frame arrives while a directory revision is pending, this ACK marks the directory revision applied even though `onRelayPasses` does not apply the device list. The DO can therefore clear its directory retry ladder and leave admission state stale; acknowledge only after applying a directory/hint fact, or track relay-pass acknowledgements separately.</comment>

<file context>
@@ -361,6 +361,10 @@ public actor IrxControlPlaneClient {
                     ["rev": String(fact.rev), "count": String(credentials.count)]
                 )
                 await handlers.onRelayPasses(credentials)
+                // Relay credentials are a revisioned control-plane fact. The
+                // handler has completed, so acknowledge it now to stop the
+                // server retry ladder and advance convergence state.
</file context>

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Sources/Mobile/MobileHostIrxRuntime.swift">

<violation number="1" location="Sources/Mobile/MobileHostIrxRuntime.swift:658">
P2: When the list is stale, absent, or the endpoint was delisted between the hello and registry check, this callback returns `false` and the registry reports `.revoked` for every case. Preserve the judge's denial code through the registry check so recoverable lease/list failures are not presented as permanent revocation.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: When the list is stale, absent, or the endpoint was delisted between the hello and registry check, this callback returns false and the registry reports .revoked for every case. Preserve the judge's denial code through the registry check so recoverable lease/list failures are not presented as permanent revocation.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Sources/Mobile/MobileHostIrxRuntime.swift, line 658:

<comment>When the list is stale, absent, or the endpoint was delisted between the hello and registry check, this callback returns `false` and the registry reports `.revoked` for every case. Preserve the judge's denial code through the registry check so recoverable lease/list failures are not presented as permanent revocation.</comment>

<file context>
@@ -651,7 +651,20 @@ final class MobileHostIrxRuntime {
+            deviceID: peer.deviceID,
+            sessionID: sessionID,
+            connection: irx,
+            stillAuthorized: { endpointIDHex in
+                do {
+                    _ = try judge.judgment()(nil, endpointIDHex)
</file context>

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxJSONCache.swift">

<violation number="1" location="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxJSONCache.swift:176">
P2: Release construction now preserves legacy cache files without performing the identity-validated migration promised by this comment. Wire the migration and cleanup into the factory, or remove the legacy files only after a validated replacement, so stale account state cannot persist and be reused by an unscoped broker.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Release construction now preserves legacy cache files without performing the identity-validated migration promised by this comment. Wire the migration and cleanup into the factory, or remove the legacy files only after a validated replacement, so stale account state cannot persist and be reused by an unscoped broker.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxJSONCache.swift, line 176:

<comment>Release construction now preserves legacy cache files without performing the identity-validated migration promised by this comment. Wire the migration and cleanup into the factory, or remove the legacy files only after a validated replacement, so stale account state cannot persist and be reused by an unscoped broker.</comment>

<file context>
@@ -173,9 +173,9 @@ enum IrxBrokerCacheFactory {
-        // Remove the old copy so a later unscoped bootstrap cannot resurrect
-        // credentials after sign-out or account switching.
-        file.clear()
+        // Preserve the old copy until an explicit, identity-validated
+        // migration can replace it; construction must never destroy the only
+        // offline binding or credential state during an upgrade.
</file context>

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[cubic-dev-ai]

2 issues found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift">

<violation number="1" location="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift:314">
P1: When `kick()` or `stop()` runs while a frame handler is suspended, the old `route` continuation still applies that frame after the new generation starts. Recheck the generation after each awaited handler and before acknowledging, and bind acknowledgements to the frame's socket so stale frames cannot mutate the new control-plane state.</violation>
</file>

<file name="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxBrokerService.swift">

<violation number="1" location="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxBrokerService.swift:514">
P2: When a cached pushed snapshot contains duplicate relay URLs, `Dictionary(uniqueKeysWithValues:)` traps before the next pass is processed. Build the map with a uniquing closure so malformed or legacy cache data is coalesced safely.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: When kick() or stop() runs while a frame handler is suspended, the old route continuation still applies that frame after the new generation starts. Recheck the generation after each awaited handler and before acknowledging, and bind acknowledgements to the frame's socket so stale frames cannot mutate the new control-plane state.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift, line 314:

<comment>When `kick()` or `stop()` runs while a frame handler is suspended, the old `route` continuation still applies that frame after the new generation starts. Recheck the generation after each awaited handler and before acknowledging, and bind acknowledgements to the frame's socket so stale frames cannot mutate the new control-plane state.</comment>

<file context>
@@ -290,19 +302,21 @@ public actor IrxControlPlaneClient {
             @unknown default: continue
             }
-            await route(data)
+            await route(data, generation: generation)
         }
     }
</file context>

[cubic-dev-ai]

P2: When a cached pushed snapshot contains duplicate relay URLs, Dictionary(uniqueKeysWithValues:) traps before the next pass is processed. Build the map with a uniquing closure so malformed or legacy cache data is coalesced safely.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxBrokerService.swift, line 514:

<comment>When a cached pushed snapshot contains duplicate relay URLs, `Dictionary(uniqueKeysWithValues:)` traps before the next pass is processed. Build the map with a uniquing closure so malformed or legacy cache data is coalesced safely.</comment>

<file context>
@@ -506,28 +508,44 @@ public actor IrxBrokerService {
+        let cachedSnapshot = credentialCache.load().flatMap { snapshot in
+            snapshot.endpointIDHex == identity.endpointIDHex ? snapshot : nil
+        }
+        var mergedByRelay = Dictionary(
+            uniqueKeysWithValues: (cachedSnapshot?.credentials ?? []).map {
+                ($0.relayURL, $0)
</file context>

Suggested change

	var mergedByRelay = Dictionary(
	uniqueKeysWithValues: (cachedSnapshot?.credentials ?? []).map {
	($0.relayURL, $0)
	})
	var mergedByRelay = Dictionary(
	(cachedSnapshot?.credentials ?? []).map {
	($0.relayURL, $0)
	},
	uniquingKeysWith: { _, latest in latest })

[cubic-dev-ai]

3 issues found across 5 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift">

<violation number="1" location="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift:431">
P1: When a directory callback fails during an initial snapshot, this line suppresses the ack but `snapshot_complete` still persists that revision as `haveRev`. The next reconnect takes the DO's resumed fast path and skips the failed directory, leaving list-auth state stale; persist the cursor only through the highest contiguous applied revision, or otherwise force an unacknowledged snapshot to replay.</violation>
</file>

<file name="Sources/Mobile/MobileHostIrxRuntime.swift">

<violation number="1" location="Sources/Mobile/MobileHostIrxRuntime.swift:470">
P1: When the secure-store write fails, this guard drops the new directory before enforcing it, so a revoked or delisted peer remains admitted under the old lease. Apply and enforce the snapshot in memory (or clear admission fail-closed) even when persistence fails, while returning `false` so the server retries instead of acknowledging it.</violation>
</file>

<file name="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxBrokerService.swift">

<violation number="1" location="Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxBrokerService.swift:521">
P3: When the new guard rejects pushed credentials because they are already expired (or have refreshAfter >= expiresAt), the journal records reason "stale" in the `!accepted.isEmpty` fallback, the same label already used for monotonic-freshness drops. That conflates the two rejection modes and will mislead anyone debugging the replay-rejection path. Record a distinct reason (e.g. "expired") for the new guard's rejections.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: When a directory callback fails during an initial snapshot, this line suppresses the ack but snapshot_complete still persists that revision as haveRev. The next reconnect takes the DO's resumed fast path and skips the failed directory, leaving list-auth state stale; persist the cursor only through the highest contiguous applied revision, or otherwise force an unacknowledged snapshot to replay.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/ControlPlane/IrxControlPlaneClient.swift, line 431:

<comment>When a directory callback fails during an initial snapshot, this line suppresses the ack but `snapshot_complete` still persists that revision as `haveRev`. The next reconnect takes the DO's resumed fast path and skips the failed directory, leaving list-auth state stale; persist the cursor only through the highest contiguous applied revision, or otherwise force an unacknowledged snapshot to replay.</comment>

<file context>
@@ -410,26 +411,24 @@ public actor IrxControlPlaneClient {
-                await acknowledge(rev: listFact.rev)
+                // Directory delivery is itself a revisioned fact. Ack only
+                // after every consumer reports durable application.
+                if applied { await acknowledge(rev: listFact.rev) }
             case "current":
                 // Explicit freshness re-stamp for the device-list lease.
</file context>

[cubic-dev-ai]

P1: When the secure-store write fails, this guard drops the new directory before enforcing it, so a revoked or delisted peer remains admitted under the old lease. Apply and enforce the snapshot in memory (or clear admission fail-closed) even when persistence fails, while returning false so the server retries instead of acknowledging it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Sources/Mobile/MobileHostIrxRuntime.swift, line 470:

<comment>When the secure-store write fails, this guard drops the new directory before enforcing it, so a revoked or delisted peer remains admitted under the old lease. Apply and enforce the snapshot in memory (or clear admission fail-closed) even when persistence fails, while returning `false` so the server retries instead of acknowledging it.</comment>

<file context>
@@ -452,23 +453,22 @@ final class MobileHostIrxRuntime {
             receivedAtWall: Date(),
             receivedAtMonotonic: .now
         )
+        guard await deviceListStore.persist(snapshot) else { return false }
         deviceListBox.replace(snapshot)
-        await deviceListStore.persist(snapshot)
</file context>

[cubic-dev-ai]

P3: When the new guard rejects pushed credentials because they are already expired (or have refreshAfter >= expiresAt), the journal records reason "stale" in the !accepted.isEmpty fallback, the same label already used for monotonic-freshness drops. That conflates the two rejection modes and will mislead anyone debugging the replay-rejection path. Record a distinct reason (e.g. "expired") for the new guard's rejections.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxBrokerService.swift, line 521:

<comment>When the new guard rejects pushed credentials because they are already expired (or have refreshAfter >= expiresAt), the journal records reason "stale" in the `!accepted.isEmpty` fallback, the same label already used for monotonic-freshness drops. That conflates the two rejection modes and will mislead anyone debugging the replay-rejection path. Record a distinct reason (e.g. "expired") for the new guard's rejections.</comment>

<file context>
@@ -516,7 +516,11 @@ public actor IrxBrokerService {
         var accepted: [IrxRelayCredential] = []
+        let now = Date()
         for credential in pushed {
+            guard credential.expiresAt > now,
+                credential.refreshAfter < credential.expiresAt
+            else { continue }
</file context>